European Data Protection Board issues guidelines on personal data processing related to the coronavirus pandemic

The European Data Protection Board’s guidelines concern the processing of health data for purposes of scientific research related to the COVID-19 disease and the use of location data and contact tracing applications.

The guidelines on research shed light on the most urgent questions of data protection, such as the legal basis of processing health data, the implementation of adequate safeguards, international data transfers and the exercise of data subject rights. The EU’s General Data Protection Regulation permits the processing of health data if it is necessary for scientific research. National legislation also applies to the processing of health data.

The second guideline adopted by the EDPB concerns the use of location data and contact tracing tools in connection with the coronavirus pandemic. The guideline clarifies the conditions and principles that must be taken into account when tracing contacts to break contamination chains or using location data to model the spreading of the virus. The EDPB stresses that the use of contact tracing applications should be voluntary. According to the Board, the applications should track proximity between users rather than tracing the movements of individuals.

The guidelines of the European Data Protection Board

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

More information:
Data Protection Ombudsman Reijo Aarnio, tel. +358 29 566 6730, reijo.aarnio(at)om.fi